Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
KomisarzRyba
Participant

Hello,

The case is as follows: We have a specific source address and a specific destination address. There is no problem with communication, but there are no logs. Logging is turned on. The IP addresses are on different networks, so traffic should go through the gateway. When we ping others' destination IP address, we see logs. Any ideas why we can't see the logs for specific addresses? What can we check or change?

BR,

Mateusz

0 Kudos
1 Solution

Accepted Solutions
KomisarzRyba
Participant

The problem was solved by replacing the device with a newer one.

View solution in original post

0 Kudos
11 Replies
the_rock
Legend
Legend

Those are ONLY logs you dont see?

0 Kudos
KomisarzRyba
Participant

Yes, those are only logs I don't see.

0 Kudos
the_rock
Legend
Legend

I second what Phoneboy said, you need to verify with tcpdump if its even reaching the gateway. Though, I assume it must be, since you said ping is fine, but nothing else. Did you try maybe old school tracker to see if that works?

Andy

0 Kudos
Amir_Senn
Employee
Employee

This might be matched on another rule in the rule base than other protocols.

I would suggest checking if all relevant rules have logging and also try to turn on logging of implied rules:Capture.PNG

Kind regards, Amir Senn
0 Kudos
PhoneBoy
Admin
Admin

Have you confirmed with a tcpdump and/or a traceroute that the traffic is actually passing through the gateway?

0 Kudos
KomisarzRyba
Participant

Here we can see the result of the ping and tracert test.
Src: 172.21.1.60,
Dst: 172.21.16.201
CheckPoint interface IP address: 172.21.0.1/20
Below we can see logs from pinging other addresses. These logs can be seen in Smartconsola. There are no logs to the destination address.
All rules have logging enabled. Log Implied Rules are enabled.
Any ideas?

Zrzut ekranu 2024-05-24 120046.pngdsa.pngZrzut ekranu 2024-05-24 120319.pngdsa.png

0 Kudos
Amir_Senn
Employee
Employee

From the looks of it logs might not behave the same since this is also relates to VPN. For ping we would usually expect firewall blade. Also this is not the actual ping since this is not the same IP as dst, those look like remote GW in the VPN community?

Also you have hops missing in the tracert? This might happen because of VPN encryption.

If you try to use tcpdump, check which port/service. Probably VPN ports/services.

 

Kind regards, Amir Senn
0 Kudos
KomisarzRyba
Participant

Yes, the traffic is passing through the gateway - confirmed with a tcpdump.

0 Kudos
the_rock
Legend
Legend

Try "old school" tracker, if that works, then its most likely indexing issue.

Andy

 

Screenshot_1.png

0 Kudos
the_rock
Legend
Legend

Alsso, make sure this is enabled on mgmt server object.

Andy

 

Screenshot_2.png

0 Kudos
KomisarzRyba
Participant

The problem was solved by replacing the device with a newer one.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events